Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Auto Reboot Recovery

v1.0.0

macOS 服務持久化與重啟恢復。管理 LaunchAgent、tmux bootstrap、wrapper daemon 三層架構, 確保電腦重啟後所有服務自動恢復。Use when: (1) 新增需要常駐的服務,(2) 把現有 tmux session 升級成 LaunchAgent, (3) 為互動式程式建...

0· 42·0 current·0 all-time
byJoey Luo@darwin7381
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
Name/description match the provided files: this is a macOS service persistence helper (LaunchAgents, tmux bootstrap, wrapper daemon). However the skill declares no required binaries/env but the scripts and templates clearly require tmux, launchctl, python3, npm/pnpm/bun, and other user tools; scripts are hardcoded to /Users/btai and expect ~/.bun, virtualenvs, etc. The declared requirements (none) are not proportionate to what the code actually needs.
!
Instruction Scope
SKILL.md instructs placing files into the user's home, creating LaunchAgents, and running bootstrap/restore scripts — all within the stated purpose. But the wrapper script auto-confirms 'trust this folder' prompts and the restore script launches a Claude instance with '--dangerously-skip-permissions --permission-mode bypassPermissions' and a Telegram plugin; these steps expand scope to automatically accept prompts and enable plugin permission bypass, which can unintentionally authorize networked plugins or external access to local state.
Install Mechanism
There is no automated install spec (instruction-only plus shell scripts). That lowers risk from arbitrary downloads. The only disk writes come from user-followed manual deployment of plists and scripts to standard user locations (~/.openclaw/, ~/Library/LaunchAgents/).
!
Credentials
The skill requests no env vars or credentials, but the code expects access to many user-local binaries and paths (tmux, python3, pnpm/npm/bun, ob, user home directories). It also references tunnels/proxy configuration (frp/ngrok/cloudflared) in the registry spec, which could be used to expose services externally. Required runtime privileges (writing ~/Library/LaunchAgents, creating sockets under /tmp, reading/writing ~/.openclaw/) are significant and not spelled out in metadata.
Persistence & Privilege
The skill installs LaunchAgents and wrapper daemons (user-level persistent services) by design — that is coherent with purpose. always: false is set. The persistent agents will run across reboots and can autonomously restart services; combined with the other concerns (plugin-permission bypass, tunnels), that increases potential impact, but persistence itself is expected for this functionality.
What to consider before installing
This skill is functionally coherent but contains several red flags you should review before installing: - Inspect and edit the scripts: they are hardcoded to /Users/btai and specific tool paths (~/.bun, project venvs). Replace those with variables or your own paths; do not deploy blind copies. - Confirm required binaries: ensure tmux, launchctl, python3, npm/pnpm/bun, and any referenced tools exist and are the versions you trust. The skill did not declare these requirements in metadata. - Remove or change dangerous flags: the restore script launches Claude with '--dangerously-skip-permissions --permission-mode bypassPermissions' and a Telegram plugin. That gives plugins elevated access and can bridge external messages into your environment—remove or understand these flags before use. - Check auto-confirm behavior: wrapper scripts will send Enter to confirm "trust this folder" prompts automatically. That may approve unexpected prompts; consider removing automated confirmations. - Review network/tunnel settings: the registry supports frp/ngrok/cloudflared; if you create tunnels, verify what is exposed externally and who can access it. - Test safely: try this in a disposable VM or non-critical account first. Monitor ~/.openclaw/logs after deploying, and only load plist files you generated and verified. If you want, provide the paths you intend to use and I can suggest exact edits to the scripts (remove hardcoded HOME, remove bypass flags, and list the minimum required binaries) so the skill metadata matches its runtime requirements.

Like a lobster shell, security has layers — review code before you run it.

latestvk970acqcnj39vpst61gegcj99984hh7q

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments